Following a recommendation to isolate a host

To follow a recommendation to isolate a host from the network:

1. In the recommendation box, select Isolate <host name>.

   This opens the host isolation settings window for the host from the event you are working on.

2. In the Disable isolation after field, enter the time in hours (1 to 9,999) during which network isolation of the host will be active.
3. In the Exclusions for the host isolation rule settings group, in the Traffic direction list, select the direction of network traffic that must not be blocked:
   • Incoming/Outgoing.
   • Incoming.
   • Outgoing.
4. In the IP field, enter the IP address whose network traffic must not be blocked.

   If you are using Kaspersky Endpoint Agent in the role of the Endpoint Agent component, you can use a proxy server for the connection of Kaspersky Endpoint Agent for Windows with Kaspersky Anti Targeted Attack Platform. When you add this proxy server to exclusions, network resources that can be accessed through the proxy server are also added to exclusions. If network resources that are accessed through the proxy server are added to exclusions, but the proxy server itself is not, such exclusions do not work.

5. If you selected Incoming or Outgoing, in the Ports field, enter the connection ports.
6. If you want to add more than one exclusion, click Add and repeat the steps to fill in the Traffic direction, IP and Ports fields.
7. Click Save.

Information about host isolation is displayed in the Endpoint Agents section of the web interface.

You can also create a network isolation rule by clicking the Isolate <host name> link in the alert information and in the Endpoint Agents section of the web interface.

Users with the Security auditor and Security officer roles cannot isolate a host from the network.